durcissement-erplibre/asn-mitigation/update-asn-ttl-blocklist.sh
2026-03-03 09:42:18 -05:00

43 lines
1.2 KiB
Bash

#!/usr/bin/env bash
set -euo pipefail
DENYLIST="/etc/edge/asn-denylist.txt"
ALLOWLIST="/etc/edge/asn-allowlist-v4.txt"
TMP="/tmp/asn_prefixes_v4.txt"
SETDENY="inet filter asn_deny_v4"
SETALLOW="inet filter asn_allow_v4"
TTL="7d"
command -v nft >/dev/null
command -v curl >/dev/null
command -v jq >/dev/null
mkdir -p /etc/edge
: > "$TMP"
# Allowlist (static)
if [[ -f "$ALLOWLIST" ]]; then
nft "flush set $SETALLOW" || true
while read -r cidr; do
[[ -z "${cidr}" || "${cidr:0:1}" == "#" ]] && continue
nft "add element $SETALLOW { $cidr }" || true
done < "$ALLOWLIST"
fi
# RIPEstat: announced prefixes for an ASN
while read -r asn; do
[[ -z "${asn}" || "${asn:0:1}" == "#" ]] && continue
asn="${asn#AS}"
url="https://stat.ripe.net/data/announced-prefixes/data.json?resource=AS${asn}"
curl -fsS "$url" | jq -r '.data.prefixes[]?.prefix' | awk -F/ '$1 ~ /^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$/ {print $0}' >> "$TMP"
done < "$DENYLIST"
sort -u -o "$TMP" "$TMP"
# Refresh TTL by re-adding elements
while read -r cidr; do
nft "add element $SETDENY { $cidr timeout $TTL }" || true
done < "$TMP"
echo "ASN deny refreshed: $(wc -l < "$TMP") IPv4 prefixes (TTL=$TTL)"